1. Field of the Invention
This invention relates to the field of data processing systems. More particularly, this invention relates to scanning for malware, such as, for example, computer viruses, Trojans, worms, banned files and banned words within e-mail messages.
2. Description of the Prior Art
It is known to provide malware scanners that operate using a library of malware signatures each comprising a plurality of characteristics identifying a particular piece of malware. The scanner searches within a computer file to be scanned to see if it contains data matching the signatures. This is a relatively efficient and effective methodology.
A problem arises when scanning compressed computer files. The compression performed upon such computer files alters the data values making up the computer file such that characteristics indicative of a computer virus will be altered by the compression process into a form in which they will not match the virus signatures within the library. In order to deal with this, the known approach is to decompress the computer file to be scanned into an uncompressed form before searching that uncompressed form of the computer file for the presence of computer viruses using the virus signatures. Whilst this avoids the disguising of computer viruses by the compression applied, it has the disadvantage of consuming a significant amount of processing resources, in terms of both processing cycles and memory, in decompressing the computer file to be scanned. By their very nature, computer files that have been compressed tend to be disadvantageously large when decompressed.